@noy-db/hub 0.7.0-pre.8 → 0.7.0-pre.9

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog — hub
 
+## 0.7.0-pre.9
+
+### Minor Changes
+
+- Add an authenticated, comparable roster epoch (#1097).
+
+  A roster tag authenticates the roster's **contents** and makes no claim about being **current**. That gap is reachable without forging anything: there is no role-change API, so narrowing a user's standing means calling `grant` again with a lower role, and that write overwrites in place. The previous, broader file was legitimately minted by the vault — so a store that kept a copy can re-serve it. The KEK unwraps, the canary checks out, the tag verifies, and the replayed file **restores the higher role**, usably.
+
+  The rotation half of #1097 already shipped and converts live access back into stale access. It cannot touch the role, because role gates capabilities rather than keys.
+
+  ## What is new
+
+  - `KeyringFile.roster_epoch?: number`, bumped on every roster write and bound into `rosterCanonical`, so a store can neither edit nor strip it.
+  - `assertRosterEpochCurrent(found, expected, userId)` — refuses a keyring older than a floor the caller obtained **out of band**.
+  - Two `KeyringTamperedReason` codes: `roster-epoch-rewound` and `roster-epoch-absent`.
+
+  ## Why an out-of-band anchor
+
+  An epoch stored beside the roster is not an anchor — a store rewinding the roster rewinds the epoch with it. It becomes one only when compared against a value that reached the reader by a channel the store does not carry. **Hub owns the epoch and the comparison; who carries the expectation is deliberately the consumer's problem**, because hub cannot know which channel a deployment trusts.
+
+  Considered and rejected, recorded so they are not re-derived: **time** (defeats long rewinds, useless against fresh ones — and a narrowing replay is entirely the fresh case) and **the vault head** (circular: head buckets are read with a keyring-issued DEK, and a rewound roster renders as the benign `no-expectations` verdict).
+
+  ## Not a format break
+
+  Binding the epoch **conditionally** is what makes this additive. `stable()` drops `undefined`, so a keyring written before the epoch existed canonicalises byte-identically and its existing tag still verifies. Binding it as `?? null` — the shape every other optional field uses — would have failed every pre-existing tag and rendered every existing vault unopenable.
+
+  ## Opt-in, and absence is never zero
+
+  With no expected epoch this changes nothing for a caller. When one is supplied, a file carrying **no** epoch is refused as `roster-epoch-absent` rather than treated as epoch 0 — treating absence as zero would accept every pre-epoch file, which is exactly the replay the mechanism exists to refuse. `found > expected` is accepted: the anchor is a floor, not an equality, since a roster may legitimately have moved on since an invite was minted.
+
+  All thirteen roster-mint sites stamp the epoch before the tag is minted, and `writeKeyringFile` now refuses to write a keyring without one — an output-domain guard, so a future mint site cannot ship the field empty.
+
+### Patch Changes
+
+- Satellite hub peers now publish as a caret **range** instead of an exact version (#1228).
+
+  Every `@noy-db/*` satellite declared `peerDependencies['@noy-db/hub'] = "workspace:*"`, which **publishes as an exact version**:
+
+  ```
+  workspace:*   ->   "@noy-db/hub": "0.7.0-pre.8"     exact
+  workspace:^   ->   "@noy-db/hub": "^0.7.0-pre.8"    a range
+  ```
+
+  Exact peers make the satellite set co-installable **only when every member came from the same cut**. Measured against published packages:
+
+  ```
+  npm i @noy-db/as-csv@0.7.0-pre.6 @noy-db/in-vue@0.7.0-pre.5   ->  exit 1, ERESOLVE
+  npm i @noy-db/as-csv@0.7.0-pre.6 @noy-db/in-vue@0.7.0-pre.6   ->  exit 0
+  ```
+
+  No hub version satisfies two different exact peers, so any lag — a satellite not republished in a given release, or a consumer upgrading one package — made a pair uninstallable by name. Caret ranges are jointly satisfiable (`hub@pre.8` satisfies both `^pre.7` and `^pre.8`) and still stop at the next minor, so a satellite never claims to work against a hub line it has not seen.
+
+  ## The reason for the old form did not hold
+
+  The architecture rule mandated `workspace:*` because `workspace:^` "trips the changeset-cli pre-1.0 dep-propagation heuristic and forces unintended major bumps on every dependent". `release.mjs`'s own header contradicted that all along: the heuristic fires **"even with loose `workspace:*` constraints"**. The peer form never prevented the bumps — the normalizer does.
+
+  Verified rather than reasoned: a full `release:version` was run with all 50 satellites on `workspace:^`. The line advanced normally, the normalizer corrected the heuristic as usual, and every package landed on one version.
+
+  **Nothing breaks for existing consumers.** A range is strictly more permissive than the exact version it replaces, so anything that resolved before still resolves. The `peer-deps` architecture rule now requires `workspace:^` and is mutation-checked.
+
 ## 0.7.0-pre.8
 
 ### Patch Changes

package/dist/api-GJQF7OAJ.js

@@ -0,0 +1,20 @@
+import {
+  UserApi,
+  createUserApi
+} from "./chunk-357ECVLE.js";
+import "./chunk-MV2OEK3K.js";
+import "./chunk-DOPZWTMJ.js";
+import "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-USKHHOIV.js";
+import "./chunk-N4CHCXDL.js";
+import "./chunk-SW4TOSJL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  UserApi,
+  createUserApi
+};
+//# sourceMappingURL=api-GJQF7OAJ.js.map

package/dist/as/index.js

@@ -1,23 +1,23 @@
 import "../chunk-UBSFPGVJ.js";
-import "../chunk-XWNLKG6R.js";
+import "../chunk-PCIBCL26.js";
 import {
   applyListProjection
 } from "../chunk-VG2ZSFYD.js";
 import "../chunk-KHKKD62N.js";
-import "../chunk-P6ASQOZR.js";
+import "../chunk-VT4DTCK5.js";
 import "../chunk-Y2NBBT6K.js";
-import "../chunk-626TSARM.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+import "../chunk-I5LSKXT6.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   ValidationError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/port/as/active.ts

package/dist/at/index.js

@@ -3,16 +3,16 @@ import {
   MemorySealer,
   SEALED_SECRET_RECORD_ID,
   parseSealedEnvelope
-} from "../chunk-2QNKXGUS.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-JUBWUJY5.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
-import "../chunk-JBIV4FLR.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MemoryRecipientSealer,

package/dist/attestation/index.js

@@ -1,42 +1,42 @@
 import {
   issueAttestationCore
-} from "../chunk-L3FHEWA3.js";
+} from "../chunk-LUVGSKXE.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-BWWUXE3L.js";
+} from "../chunk-FPN5D4JX.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-LFDMKZIP.js";
+} from "../chunk-GKOJR53Y.js";
 import {
   NO_ATTESTATION
-} from "../chunk-E6YA6UAP.js";
+} from "../chunk-FLRLZ4XZ.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   AttestationError,
   AttestationNotEnabledError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/attestation/active.ts
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-2DGG7NKE.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-64N6OG7U.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-HJHTGX7X.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-5TA7FUC3.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-4NRSCPNW.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-PUJKRYJF.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-4NRSCPNW.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-PUJKRYJF.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-4NRSCPNW.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-PUJKRYJF.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-4NRSCPNW.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-PUJKRYJF.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-SZBDQQSL.js → backup-QZQEP5RO.js}

@@ -3,37 +3,37 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-626TSARM.js";
+} from "./chunk-I5LSKXT6.js";
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-S3I7VKID.js";
+} from "./chunk-H5GVPOB4.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
   PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION
-} from "./chunk-Z7ZXZL6Y.js";
+} from "./chunk-Q2ZN5DWZ.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-BYBB4ABD.js";
+import "./chunk-DOPZWTMJ.js";
 import {
   buildRecordEnvelope
-} from "./chunk-QU3YUP2X.js";
-import "./chunk-FOG7YEJP.js";
-import "./chunk-KDJGJR7F.js";
-import "./chunk-LKFKXS5K.js";
+} from "./chunk-4RUFYGWG.js";
+import "./chunk-XGXVPCYW.js";
+import "./chunk-CWFH36SI.js";
+import "./chunk-KZTPL7NL.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-W5LHQXZU.js";
+import "./chunk-USKHHOIV.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-GU3LQYW2.js";
+} from "./chunk-N4CHCXDL.js";
 import {
   BackupCorruptedError,
   BackupLedgerError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-pod/backup.ts
@@ -262,4 +262,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-SZBDQQSL.js.map
+//# sourceMappingURL=backup-QZQEP5RO.js.map

package/dist/blobs/index.js

@@ -10,7 +10,7 @@ import {
   createExportBlobsHandle,
   reportOrphanBlobChunks,
   runCompaction
-} from "../chunk-ZKRRBRSZ.js";
+} from "../chunk-IS5LFHV2.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -25,21 +25,21 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-ZQ2UUHSL.js";
-import "../chunk-XDVVBETV.js";
-import "../chunk-HTGRQZFB.js";
-import "../chunk-POS53FG6.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-HS3LEVT4.js";
+import "../chunk-YHIAWECL.js";
+import "../chunk-DZPMKY3J.js";
+import "../chunk-IZTU6RKH.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   BlobOfflineError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/via/blob/active.ts

package/dist/broker/index.js

@@ -1,22 +1,22 @@
 import {
   NO_BROKER
-} from "../chunk-4A4TYISP.js";
+} from "../chunk-PV7XXAXK.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+} from "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-W5LHQXZU.js";
-import "../chunk-GU3LQYW2.js";
+import "../chunk-USKHHOIV.js";
+import "../chunk-N4CHCXDL.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/broker/active.ts
@@ -30,7 +30,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-IX5NFSH5.js");
+      const { enrollSeed } = await import("../seed-CG7JMJNY.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -39,7 +39,7 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-IX5NFSH5.js");
+      const { rotateSeed } = await import("../seed-CG7JMJNY.js");
       return rotateSeed({ ...ctx, config });
     },
     credentialSource(ctx, profile) {
@@ -56,7 +56,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-IX5NFSH5.js");
+          const { mintStoreCredentials } = await import("../seed-CG7JMJNY.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-CBRS2NEK.js";
-import "../chunk-JBIV4FLR.js";
+} from "../chunk-GHADG5QZ.js";
+import "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   isQuorum,

package/dist/cargo/index.js

@@ -5,11 +5,11 @@ import {
   describeExtraction,
   unsealDeks,
   withCargo
-} from "../chunk-OMHHGOG4.js";
+} from "../chunk-MQPHKJ74.js";
 import {
   extractPartition,
   walkClosure
-} from "../chunk-7CWII4BL.js";
+} from "../chunk-7XT7KZTN.js";
 import {
   diffVault
 } from "../chunk-LFUID7OW.js";
@@ -18,61 +18,61 @@ import {
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-4MZEZ37W.js";
-import "../chunk-7XODKGTW.js";
-import "../chunk-4TZUFNXL.js";
+} from "../chunk-HLFLJCDX.js";
+import "../chunk-5EC7X5QA.js";
+import "../chunk-P22XPNFW.js";
 import {
   NO_CARGO
-} from "../chunk-XJ3FEKEY.js";
-import "../chunk-2QNKXGUS.js";
+} from "../chunk-FKQCC4C5.js";
+import "../chunk-JUBWUJY5.js";
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-CBRS2NEK.js";
-import "../chunk-626TSARM.js";
+} from "../chunk-GHADG5QZ.js";
+import "../chunk-I5LSKXT6.js";
 import {
   CustodyApi
-} from "../chunk-672U6STZ.js";
-import "../chunk-6AQIFBSP.js";
-import "../chunk-44C2URL7.js";
+} from "../chunk-K432FT7T.js";
+import "../chunk-RCONOOVF.js";
+import "../chunk-NMDMSHBF.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-ZQ2UUHSL.js";
+import "../chunk-HS3LEVT4.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-4G25SDQL.js";
+} from "../chunk-4U52PMEL.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-ATL3ZVXT.js";
 import {
   readPath
 } from "../chunk-NSITFOCJ.js";
-import "../chunk-X67FCULK.js";
-import "../chunk-XDVVBETV.js";
-import "../chunk-ZTYG36DH.js";
-import "../chunk-26W5VETY.js";
-import "../chunk-HTGRQZFB.js";
+import "../chunk-DIVY2CJZ.js";
+import "../chunk-YHIAWECL.js";
+import "../chunk-OHGCRKWA.js";
+import "../chunk-MV2OEK3K.js";
+import "../chunk-DZPMKY3J.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-UPJMBMCR.js";
+import "../chunk-OKCQNMO6.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-WLFABTZ6.js";
-import "../chunk-POS53FG6.js";
-import "../chunk-BYBB4ABD.js";
-import "../chunk-QU3YUP2X.js";
-import "../chunk-FOG7YEJP.js";
-import "../chunk-KDJGJR7F.js";
-import "../chunk-LKFKXS5K.js";
+import "../chunk-JRWLUWDM.js";
+import "../chunk-IZTU6RKH.js";
+import "../chunk-DOPZWTMJ.js";
+import "../chunk-4RUFYGWG.js";
+import "../chunk-XGXVPCYW.js";
+import "../chunk-CWFH36SI.js";
+import "../chunk-KZTPL7NL.js";
 import "../chunk-LP7BEXCT.js";
 import {
   sha256Hex
-} from "../chunk-W5LHQXZU.js";
+} from "../chunk-USKHHOIV.js";
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-GU3LQYW2.js";
+} from "../chunk-N4CHCXDL.js";
 import {
   AdoptionStateError,
   CargoNotEnabledError,
@@ -87,7 +87,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-JBIV4FLR.js";
+} from "../chunk-SW4TOSJL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   AdoptionStateError,

package/dist/{chunk-AB5P32RE.js → chunk-2DGBRE4K.js}

@@ -1,7 +1,7 @@
 import {
   FieldFrozenError,
   InvariantError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-audit/guards/executor.ts
 var GuardExecutor = {
@@ -77,4 +77,4 @@ function deepEqual(a, b) {
 export {
   GuardExecutor
 };
-//# sourceMappingURL=chunk-AB5P32RE.js.map
+//# sourceMappingURL=chunk-2DGBRE4K.js.map

package/dist/{chunk-XVU7J43V.js → chunk-2E2LT37H.js}

@@ -1,6 +1,6 @@
 import {
   ReadOnlyFrameError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-fork/shadow/vault-frame.ts
 var VaultFrame = class {
@@ -71,4 +71,4 @@ export {
   VaultFrame,
   CollectionFrame
 };
-//# sourceMappingURL=chunk-XVU7J43V.js.map
+//# sourceMappingURL=chunk-2E2LT37H.js.map

package/dist/{chunk-ILSR22WM.js → chunk-2MQ2D5OZ.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-7XODKGTW.js";
+} from "./chunk-5EC7X5QA.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-4TZUFNXL.js";
+} from "./chunk-P22XPNFW.js";
 import {
   buildRecordEnvelope
-} from "./chunk-QU3YUP2X.js";
+} from "./chunk-4RUFYGWG.js";
 import {
   NoydbError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -158,4 +158,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-ILSR22WM.js.map
+//# sourceMappingURL=chunk-2MQ2D5OZ.js.map

package/dist/{chunk-JHLJQUXU.js → chunk-357ECVLE.js}

@@ -4,10 +4,10 @@ import {
   persistUserVisibility,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-26W5VETY.js";
+} from "./chunk-MV2OEK3K.js";
 import {
   PolicyDeniedError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-party/directory/user-envelope/api.ts
 var UserApi = class {
@@ -379,4 +379,4 @@ export {
   UserApi,
   createUserApi
 };
-//# sourceMappingURL=chunk-JHLJQUXU.js.map
+//# sourceMappingURL=chunk-357ECVLE.js.map

package/dist/{chunk-SHILAQH5.js → chunk-3GIA3HJ2.js}

@@ -1,6 +1,6 @@
 import {
   DuplicateBehaviorNameError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-audit/guards/registry.ts
 var GuardRegistry = class {
@@ -141,4 +141,4 @@ var GuardRegistry = class {
 export {
   GuardRegistry
 };
-//# sourceMappingURL=chunk-SHILAQH5.js.map
+//# sourceMappingURL=chunk-3GIA3HJ2.js.map

package/dist/{chunk-XLPXGN66.js → chunk-3SWP2FYA.js}

@@ -2,33 +2,33 @@ import {
   isCollectLeg,
   resolveLegOwner,
   wrapDbWithPredicates
-} from "./chunk-4ZPE6SKS.js";
+} from "./chunk-75WNTBZL.js";
 import {
   canonicalizeMoneyFieldsAsDecimal,
   decodeMoneyFields,
   exactMath
-} from "./chunk-TOV6VMHF.js";
+} from "./chunk-U3RMWOXY.js";
 import {
   putDerivedOutput
-} from "./chunk-VVAVTSTR.js";
+} from "./chunk-FRIVOR5N.js";
 import {
   DEFAULT_JOIN_MAX_ROWS
-} from "./chunk-XSN63FUS.js";
+} from "./chunk-AW4KTQA4.js";
 import {
   groupAndReduce
-} from "./chunk-4G25SDQL.js";
+} from "./chunk-4U52PMEL.js";
 import {
   canonicalGroupKey
 } from "./chunk-XZHEOSQ2.js";
 import {
   applyI18nLocale
-} from "./chunk-X67FCULK.js";
+} from "./chunk-DIVY2CJZ.js";
 import {
   JoinTooLargeError,
   LocaleNotSpecifiedError,
   MaterializedViewConfigError,
   MaterializedViewTooLargeError
-} from "./chunk-JBIV4FLR.js";
+} from "./chunk-SW4TOSJL.js";
 
 // src/with-formula/materialized-views/executor.ts
 var DEFAULT_MAX_ROWS = 1e5;
@@ -342,4 +342,4 @@ async function listOutputIds(outputColl) {
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=chunk-XLPXGN66.js.map
+//# sourceMappingURL=chunk-3SWP2FYA.js.map